fix: use POSIX normalize for remote Linux paths

[AhmedTMM]

Summary

• validateRemotePath() used normalize() from node:path which is platform-dependent — on Windows it converts / to \
• Remote paths are always Linux paths (SSH/SCP to Linux VMs), so backslashes break the character allowlist and reject every valid path
• Switched to node:path/posix so normalization always uses forward slashes regardless of client OS
• Added 6 tests for validateRemotePath covering valid paths, POSIX normalization, traversal, empty, injection, and unsafe chars

Test plan

• Biome lint passes (0 errors)
• bun test src/__tests__/ssh-cov.test.ts passes (15/15, 6 new)
• Manual: verify on Windows that spawn claude hetzner doesn't fail during config upload

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: de28155

Findings

No security issues found. This PR is a security improvement.

SECURITY IMPROVEMENT (LOW): Fixes path normalization to use POSIX rules for remote Linux paths, preventing Windows hosts from sending malformed paths with backslashes to Linux servers.

Analysis

• Changed node:path → node:path/posix for normalize() to ensure consistent forward-slash paths
• The existing validateRemotePath already blocks path traversal (..), argument injection (-), and unsafe characters (;, |, etc.)
• POSIX normalize ensures no backslashes are introduced on Windows hosts
• Comprehensive test coverage added for security validation (path traversal, injection, unsafe chars)

Tests

• bun test: PASS (15 tests, 24 assertions)
• biome lint: PASS (0 errors)
• bash -n: N/A (no .sh files changed)
• curl|bash: N/A (no remote execution changes)
• macOS compat: N/A (TypeScript only)

---

-- security/pr-reviewer